Researchers reveal VoIP vulnerabilities

Share this article:
VoIPshield Laboratories has alerted companies that market voice over IP systems of new security vulnerabilities.

The VoIP vulnerabilities, if successfully exploited, could affect brand reputation, internal productivity, and competitive advantage, researchers said.

VoIPshield does not reveal specifics about the vulnerabilities to the public, Bogdan Materna, VoIPshield Laboratories chief technology officer, told SCMagazineUS.com on Friday.

“We don't want to give hackers information to work from,” he said.

Instead, under its disclosure policy, VoIPshield works with the VoIP vendors to assist them in reproducing the vulnerabilities in their labs.

VoIPshield classifies the vulnerabilities into different categories -- remote code execution; unauthorized access; denial of service; and information harvesting – and rates them according to their severity.

Materna said that by passing the information of their vulnerability research, the company hopes that vendors will be able to take action to create patches for potential exploits. Avaya, Cisco and Nortel have acknowledged the latest vulnerabilities on their websites, and are issuing their own security advisories.

VoIP vulnerabilities appear to be increasing because more security researchers are focused on finding them, Lawrence Orans of Gartner told SCMagazineUS.com.

“Three to four years ago, there was far less focus on IP telephony vulnerabilities because the IP telephony installed base was much smaller,” Orans said. "In 2008, most of the widely deployed telephony systems have vulnerabilities that permit DOS attacks, privilege escalation and code execution attacks."

Because of these risks, he added, managers should scan their applications for vulnerabilities on a regular basis and prioritize software patches that resolve critical vulnerabilities.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

LEADS Act addresses gov't procedure for requesting data stored abroad

LEADS Act addresses gov't procedure for requesting data ...

Senators introduced the legislation last week as a means of amending the Electronic Communications Privacy Act (ECPA).

Report: Intrustion prevention systems made a comeback in 2013

Report: Intrustion prevention systems made a comeback in ...

A new report indicates that intrusion prevention systems grew 4.2 percent in 2013, with growth predicted to continue.

Mobile device security sacrificed for productivity, study says

Mobile device security sacrificed for productivity, study says

A Ponemon Institute study, sponsored by Raytheon, revealed that employees increasingly use mobile devices for work but cut corners and circumvent security.